the answer says that this is false. But I think this is a true statement.
I did not understand this, SingleThreadModel guarantees one single thread per Servlet, but there may be more than one thread as long as there are multiple servlets. If so, HttpSession is not protected against that.
On first question you are right about class vs instance variable . On second you are too . Expression is a scriptlet . On third , the container can intantiate more than none servlet if the servlet implements SingleThreadModel . A client makes a request and a Session is created with a sessionId that will de send back to the client . on second request the client send the sessionId back and the container checks if there is a Session with the sessionId . I think that helps